CVE-2021-24562
📋 TL;DR
This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in the LifterLMS WordPress plugin. It allows authenticated students to access other students' answers and grades by manipulating object identifiers. WordPress sites using vulnerable versions of the LifterLMS plugin are affected.
💻 Affected Systems
- LifterLMS WordPress Plugin
📦 What is this software?
Lifterlms by Lifterlms
⚠️ Risk & Real-World Impact
Worst Case
Mass data breach of all student submissions and grades, leading to privacy violations, academic integrity issues, and potential regulatory penalties.
Likely Case
Students accessing limited numbers of other students' work, compromising academic integrity and violating privacy expectations.
If Mitigated
Minimal impact with proper access controls and monitoring, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires authenticated student access and involves simple parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.21.2
Vendor Advisory: https://make.lifterlms.com/2021/05/17/lifterlms-version-4-21-2/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find LifterLMS and click 'Update Now'. 4. Verify version is 4.21.2 or later.
🔧 Temporary Workarounds
Disable Student Access
allTemporarily disable student access to the LMS until patching is complete.
Access Restriction via .htaccess
linuxRestrict access to vulnerable endpoints using web server configuration.
# Add to .htaccess in WordPress root directory
<FilesMatch "\.(php|inc)$">
Order Deny,Allow
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Implement strict access controls and monitoring for student activity logs.
- Deploy a web application firewall (WAF) with IDOR protection rules.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > LifterLMS version. If version is below 4.21.2, system is vulnerable.Check Version:
wp plugin list --name=lifterlms --field=versionVerify Fix Applied:
Confirm LifterLMS plugin version is 4.21.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to student submission endpoints
- Multiple student ID parameter variations in single session
Network Indicators:
- HTTP requests with manipulated student ID parameters
- Unusual traffic to /wp-content/plugins/lifterlms/ endpoints
SIEM Query:
source="wordpress.log" AND ("lifterlms" OR "student_id") AND status=200 AND user_agent NOT IN ("admin_user_agents")